Privacy

The controller of your personal data is DUGUIDE, an independent publishing project operated from Dubai, United Arab Emirates, by Anastasiia Zakharchenko. For anything on this page, write to hello@duguide.ae.

If you create an account: your name, your email address, the places you save, the private notes you write on them, and any rating you give. Signing in with Google shares your Google name, email address and profile picture with us; we never see your Google password. Signing in by email uses a one-time code — there is no password to store.

If you only browse: we count, in your own browser, how many different places you have opened, so we know when to invite you to create an account. That counter never leaves your device.

If you tap Near me on the map: your browser asks your permission and then gives your position to the page, which uses it to show where you are and which places are closest. The position itself stays in your browser — it is not sent to us or stored. Analytics records only the outcome (shown, not allowed, or outside Dubai), never where you are. The map then loads the map images around you from the map provider below, as any map does.

Usage analytics (only with your consent): which pages are opened, what is typed into the site search, which filters and places are used, whether a sign-in succeeded, the site that linked here, and an approximate location (country and city) derived from your IP address. Signed-in visitors are recorded under a random account identifier — never under a name or an email. See Cookies and analytics below for how to switch this on or off.

If you write to us — including the optional reason you can give when deleting your account — we keep the message and your address for as long as we need to reply.

We do not collect payment details, government identifiers, or any sensitive personal data (health, beliefs, biometrics). We do not build profiles from other sources and we do not make automated decisions about you.

• To run your account — save places, keep your notes, greet you by name, send you the one-time sign-in code and a single welcome email. Basis: this is necessary to provide the service you asked for (PDPL Article 4(1)(a)).
• To understand how the guide is used — which places people look for and cannot find, where a sign-in fails, which pages nobody opens. Basis: your consent, given through the analytics choice described below and withdrawable at any time.
• To answer you when you write to us. Basis: your request.
• To keep the site secure — hosting logs that record requests to the site. Basis: our legitimate need to run and protect the service.

We do not sell your data, we do not show ads, and we do not share your data with advertisers. We do not send newsletters or marketing unless you separately opt in, and you can opt out of anything at any time.

Strictly necessary. A sign-in cookie keeps you signed in. Your browser's local storage holds the free-preview counter and a few interface preferences (for example that you closed a message). These are needed for the site to work and need no consent.

Analytics (optional). With your consent, Amplitude sets a random device identifier so that a visit today and a visit next week count as the same person. It is not used to follow you across other websites. Nothing is loaded and nothing is sent until you answer the question at the bottom of the page; you can decline there, and change your mind later from Cookie settings in the footer of every page — declining never limits what you can read or do on DUGUIDE.

We use a small number of service providers. Each processes data on our written instructions only, for the purpose named, and may not use it for anything else.

• Supabase — stores your account, saved places and notes, and issues the sign-in codes.
• Amplitude (United States) — stores the usage analytics, under the random identifier described above, only if you have consented.
• Vercel — hosts the site and delivers it to your browser; its request logs are used for security and troubleshooting.
• Resend — sends the account emails (sign-in code, welcome).
• OpenFreeMap and, as a backup, VersaTiles — deliver the map images on the homepage. Like any website, they receive your IP address and which part of the map your browser shows — after Near me, that is the area around you. They receive nothing else from us. If the map fails to load, your browser sends us a short technical note (no personal data) so we can fix it.
• Google — only if you choose to sign in with Google, under Google's own privacy policy.

Transfers outside the UAE. These providers store data outside the United Arab Emirates, including in the United States and the European Union. We transfer it there on the basis of the providers' contractual data-protection commitments (PDPL Articles 22–23), and — for analytics — your explicit consent. Beyond these providers, the only people who see your data are the people who make DUGUIDE. We disclose data to authorities only where the law requires it.

• Account data — until you delete your account. Deletion is immediate and complete: account, saved places, notes and ratings go at once.
• Analytics — kept for up to 24 months, then deleted or made anonymous. Withdrawing consent stops new collection at once.
• Hosting logs — kept by Vercel for a short period for security, then deleted.
• Messages you send us — for as long as needed to deal with them, then deleted.

Under the PDPL you can, at any time and free of charge:

• Access the personal data we hold about you and receive a copy in a readable, portable format.
• Correct it — your name and email can be changed on your profile page; anything else, write to us.
• Delete it — from the profile page, or by writing to us. This is a real deletion with no undo.
• Restrict or object to a particular use of your data.
• Withdraw consent to analytics at any time, from Cookie settings in the footer of any page. Withdrawal stops collection at once and does not affect processing that already took place.
• Complain — to us first, so we can put it right; and to the UAE Data Office if you are not satisfied with our answer.

Write to hello@duguide.ae from the address on your account. We answer within 30 days. We may ask you to confirm your identity before acting on a request, and only ever to protect your data.

DUGUIDE is written for adults and is not directed at anyone under 18. We do not knowingly collect data from children; if you believe a child has created an account, write to us and we will delete it.

Data travels only over encrypted connections (HTTPS). Access to your account data is restricted by database rules so that only you — signed in — can read your own saved places and notes. Sign-in codes expire within minutes and are single-use. We keep the amount of data we hold to what this page lists. If a breach ever put your data at risk, we would notify the UAE Data Office and you, as the law requires.

If we change what we collect or why, this page changes first and the date at the top moves. For a change that needs your consent — a new purpose, a new kind of data — we will ask you again rather than rely on this page alone.

Questions about this page, your data, or anything else: hello@duguide.ae.